debian/patches/pve/0005-api-extensions-add-and-document-cgroup_advanced_isol.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Christian Brauner <christian.brauner@ubuntu.com>
   3 Date: Sat, 4 Apr 2020 12:07:43 +0200
   4 Subject: [PATCH lxc] api-extensions: add and document
   5  cgroup_advanced_isolation
   6
   7 Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
   8 ---
   9  doc/api-extensions.md    | 4 ++++
  10  src/lxc/api_extensions.h | 1 +
  11  2 files changed, 5 insertions(+)
  12
  13 diff --git a/doc/api-extensions.md b/doc/api-extensions.md
  14 index 98686f9ed..fe1b1bdb7 100644
  15 --- a/doc/api-extensions.md
  16 +++ b/doc/api-extensions.md
  17 @@ -136,6 +136,10 @@ Retrieve the seccomp notifier fd from a running container.
  18
  19  Whether the seccomp notify proxy sends a long a notify fd file descriptor.
  20
  21 +## cgroup\_advanced\_isolation
  22 +
  23 +Privileged containers will usually be able to override the cgroup limits given to them. This introduces three new configuration keys `lxc.cgroup.dir.monitor`, `lxc.cgroup.dir.container`, and `lxc.cgroup.dir.container.inner`. The `lxc.cgroup.dir.monitor` and `lxc.cgroup.dir.container` keys can be used to set to place the `monitor` and the `container` into different cgroups. The `lxc.cgroup.dir.container.inner` key can be set to a cgroup that is concatenated with `lxc.cgroup.dir.container`. When `lxc.cgroup.dir.container.inner` is set the container will be placed into the `lxc.cgroup.dir.container.inner` cgroup but the limits will be set in the `lxc.cgroup.dir.container` cgroup. This way privileged containers cannot escape their cgroup limits.
  24 +
  25  ## idmapped\_mounts
  26
  27  Whether this LXC instance can handle idmapped mounts for the rootfs.
  28 diff --git a/src/lxc/api_extensions.h b/src/lxc/api_extensions.h
  29 index d99adacbe..a10f2e5f3 100644
  30 --- a/src/lxc/api_extensions.h
  31 +++ b/src/lxc/api_extensions.h
  32 @@ -45,6 +45,7 @@ static char *api_extensions[] = {
  33         "seccomp_notify_fd_active",
  34         "seccomp_proxy_send_notify_fd",
  35  #endif /* HAVE_DECL_SECCOMP_NOTIFY_FD */
  36 +       "cgroup_advanced_isolation",
  37         "idmapped_mounts",
  38         "idmapped_mounts_v2",
  39         "core_scheduling",